Check that email before you lay it on the line

A recent case highlighted how firms and employees need to be aware of data laws, says Diarmaid Condon

IN THE light of the ICS Building Society offensive email circulation case at the Employment Appeals Tribunal, where the appeal of two employees against their dismissal was upheld in the ruling, it’s interesting to consider where employees and employers stand legally in relation to the use and misuse of the internet and messaging systems in the workplace.

There are a number of infamous cases of employees blindly circulating inappropriate or downright offensive emails within and outside, the work environment. The most well documented in Ireland is probably the PricewaterhouseCoopers (PwC) ‘Top 10’ email scandal, where PwC employees were internally investigated following the circulation of an email listing the ‘Top 10’ female employees in one of its Dublin offices. Male employees ranked new female staff members via email, adding comments to the email as it went.

Then it left the office and, in computer parlance, ‘went viral’ (experienced a huge surge in popularity in a very short period of time). Essentially, a lot of people outside of PwC saw the email as it was publicly forwarded and posted on Social Networks. It was ultimately brought to the attention of management. Those who had been in receipt of the email and had forwarded it were caught, not because of a raft of high end cyber-sleuthing, but because the contributors didn’t remove their signatures as they forwarded the email.

One of last year’s most infamous instances involved the circulation by a recent Duke University graduate, Karen Owen, of a list of men with whom she had sexual relations. Owen, by her own admission, “experienced” a number of players from Duke University Lacrosse team, in particular.

However, she decided to create a PowerPoint presentation in thesis format, complete with full male evaluations and dirty talk transcripts. She passed the document to three close female friends via email, one of whom forwarded it, and the rest, as they say, is history. It went viral within days.

Oddly enough, the most infamous ‘comparison’ website is Facemash, predecessor to the now omnipresent Facebook. Creator Mark Zuckerberg initiated the site in 2003, while attending Harvard, based on the website called Hot Or Not using photos compiled from what were termed the ‘face books’ of nine Harvard houses.

It placed two photos next to each other, asking users to choose the ‘hotter’ person. Who would have guessed that this simple (and morally questionable) site would be the predecessor to a technological phenomenon that would conquer the world?

So how much access do employers have to work email accounts and other internet activity facilitated by their equipment? And more importantly, how much access are employers entitled to?

Firstly, it is important to note that the monitoring by an employer of email and internet use by workers is not explicitly covered by Irish data protection law. It comes under the general auspices of the Data Protection Acts of 1988 and 2003. In 1995, a European Commission directive enshrined a right to privacy with respect to the processing of personal data.

Employers must, at the outset of employment, provide employees with a statement of policy with regard to email and internet use in the workplace. This should describe the extent to which the employees can use communication facilities owned by the company for personal or private communications.

If surveillance or monitoring of communications use is to be carried out, the reasons and purposes for which this will be undertaken must be made clear. The employee must also be made aware of the nature of the surveillance. The employer must outline what happens when there is a breach of policy and what opportunity will be given to the employee to respond to any alleged breaches. Covert email monitoring is not permitted except to obtain evidence of criminal activity.

So, essentially, if you were not told that your email and internet use would be monitored, your employer has no right to do so. For reference, you should refer to the documentation on internet use policy received when you commenced work.

It is recommended that employers only monitor data traffic statistics, rather than content but as there is no legal imperative, it would be safe to assume that, in the name of protecting their own organisation and communications that are made in its name, company email is open to be seen by others should they wish to do so. You’ll find full information on this topic on the Citizens Information website.

In light of this you would have to question why anybody would use a work email for private communications at all. Most people can use Gmail or Hotmail accounts at work and most mobile phones can facilitate email and internet access.

Social networking and the migration of these platforms to mobile devices such as smartphones and & tablets is also creating problematic legal situations for employers and employees alike.

Laws tend to evolve slowly as court cases involving new technologies are initiated and as a result of how these technologies are used and abused in the real world.

It is practically impossible to do anything on the internet that involves interaction of some description without use of an email account.